Privacy Policy

1. Who we are and what this covers

2Web Holdings Ltd. operates Viewport Buddy. This policy covers personal information handled through the Service, including account information, captured website content, reports, and client-portal activity. It is intended for an app whose primary application servers are located in Canada.

We handle our own account, billing, support, and security records. When a customer asks us to capture a website or share a project, we process that content to provide the requested service. The customer is responsible for its authority to collect and share the underlying content. If you are reviewing a project as a client, the project owner also controls your invitation and shared project content.

2. Information we collect

• Account information: email address, optional name, password hash, email verification and account status, Terms acceptance version and time, and account activity. Passwords are not stored as plain text.
• Website and review content: domain names, URLs, sitemap information, screenshots, page metadata, layout measurements where available, analysis results, visual diffs, notes, work items, and reports. Screenshots can include personal information visible on the captured pages.
• Billing information: plan, usage, credit balances, subscription/payment status, and Stripe customer and subscription references. Payment-card entry is handled by Stripe; the app does not collect full payment-card numbers in its own forms.
• Client access and security information: project links, PINs and labels, expiry settings, sign-in times, IP addresses, browser/user-agent details for client access events, failed attempts, access blocks, and relevant administrative or error logs. Project owners can see access records for their projects.
• Communications: verification and password-reset requests, account notices, and information you supply when seeking help.

3. Why we use information

We use information to create and secure accounts; discover and capture authorized websites; provide comparisons, analyses, notes and reports; manage client access; measure plan usage; process subscriptions; send service messages; investigate problems and misuse; respond to requests; and meet legal and accounting obligations.

We collect and use information with consent where required, or where otherwise permitted by applicable law. Your agreement to the Terms is not consent to unrelated marketing. Do not submit sensitive information that is unnecessary for website review. If you provide another person’s information, you must have the appropriate authority and provide any required notices.

4. Cookies and browser storage

The app uses a session cookie for authentication and security, including protection against forged requests. The browser may temporarily store a selected plan during signup so that selection survives a reload. The current app does not require advertising cookies to operate. External payment pages may use their own cookies and storage under the provider’s policy.

You can clear or block cookies and browser storage, but sign-in, client access, or signup continuity may stop working. This draft must be updated if analytics, advertising, or other optional tracking is introduced.

5. Canadian hosting and processing outside Canada

The primary application servers are hosted in Canada. This is not a promise that all information remains in Canada. Configured hosting infrastructure, backups, email delivery, payment services, external screenshot services, and AI providers may process or store information in other countries, where local laws may permit access by courts, governments, or law-enforcement agencies.

• Stripe: receives information needed for payment, subscription management, fraud prevention, and billing.
• Capture providers: if an external screenshot service is configured, it receives the URLs and capture options and processes the rendered website content.
• AI providers: when an AI review is requested, selected screenshot sections and relevant page/check data are sent to the configured provider. A review can expose any personal information visible in those sections.
• Hosting and email providers: process infrastructure, delivery, and operational information needed to run the Service.

Deployment review required: confirm and publish the actual providers, processing regions, backup arrangements, provider retention/training terms, and contractual safeguards. Canadian hosting alone does not establish compliance with PIPEDA or applicable provincial privacy laws.

6. Sharing, reports, and client PINs

We disclose information to providers as needed to deliver the Service, to recipients you authorize, and when required or permitted by law. We may disclose relevant information to protect rights and security or in connection with a business transaction, subject to applicable privacy obligations.

A client project link and a valid PIN provide access to the project’s permitted reports, screenshots, findings, AI summaries, and shared notes. PIN holders do not need an owner account. Owners choose what to share, manage expiry, revoke access, and can review client access logs. Treat both links and PINs as confidential.

Share-report links and downloaded PDFs are separate ways to distribute content. Do not assume PIN expiry also revokes an independently created report link. Revocation prevents future access through that credential; it cannot erase copies a recipient has already saved.

7. Retention and deletion

Screenshot retention depends on your current plan. Expired images are removed by the app’s scheduled retention process; that does not mean every related URL, finding, note, usage record, or report is removed at the same time. Access logs, account records, security records, and billing records may have different retention periods.

You can export available reports and images before they expire, revoke sharing credentials, and request account deletion through the account page after cancelling an active subscription. The app deletes account-linked project data and stored files through its deletion process. Backups, legally required records, independently retained payment-provider records, and copies held by recipients may remain for their applicable retention periods.

To be finalized: document the deployed retention schedule for backups, client-access logs, support records, and billing/legal records. Do not treat a plan’s image-retention period as a promise to delete all personal information within that time.

8. Safeguards and incidents

The app uses measures including password hashing, session security, access checks, security logs, and controls for project sharing. No service can guarantee perfect security. Keep your credentials private, use appropriate access settings, and tell us if you suspect an incident. We will assess incidents and provide notifications where required by applicable law.

9. Access, correction, questions, and complaints

Subject to applicable law, you may request access to or correction of your personal information, ask about our practices and providers, or withdraw consent where it is the basis for processing. Withdrawing necessary consent may limit our ability to provide a feature or account. Some information must be retained to meet legal, security, or contractual obligations.

If the information belongs to a website captured by a customer or a client project, contact that project’s owner as well so it can address the source content and sharing settings. You can also contact us directly. We may need to verify your identity and clarify the request. You may raise an unresolved complaint with the relevant Canadian privacy regulator, including the Office of the Privacy Commissioner of Canada where applicable.

Contact details pending: 2Web Holdings Ltd.’s support/privacy contact email must be supplied before this draft is finalized.

Company/privacy mailing address: to be confirmed before publication of the final policy.

10. Updates and finalization

Material changes will be communicated as appropriate through the Service or account email. This draft should be reviewed against the actual deployment and the applicable federal and provincial privacy requirements before adoption. Designate a privacy contact and complete the contact details above before publishing the final policy.